PPasswordForge
Get PasswordForge

PasswordForge · password strength

How strong is a 4-word passphrase?

A 4-word passphrase drawn from the 7,776-word Diceware list carries 51.7 bits of entropy. Each additional word adds 12.9 bits — more than two extra random letters, and far easier to remember.

These numbers describe a password generated at random. A password a person invented — a name, a date, a word with letters swapped for digits — is worth a fraction of the same length, because an attacker guesses the pattern, not the alphabet. Entropy measures the dice, not the string.

Entropy and keyspace

AlphabetEntropyPossible passwordsVerdict
Diceware word list (7,776 words)51.7 bits3.66×10^15fair

Time to exhaust half the keyspace

Each column states the guess rate it assumes. A crack time quoted without a rate is meaningless — the same password is minutes or millennia depending on whether the attacker is typing into a login form or running eight GPUs against a stolen hash.

Attack51.7b
Online, rate-limited (10 guesses/sec)5.8×10^6 years
Online, no throttling (1 000/sec)57,928 years
Offline, slow hash — bcrypt cost 12 (20 000/sec)2,896 years
Offline, fast hash — salted SHA-256 on 8 GPUs (100 billion/sec)5.1 hours
Offline, well-funded (100 trillion/sec)18 seconds

Generate one at this strength

The generator runs in your browser using the operating system's cryptographic random source — nothing is sent anywhere. Pick a length or a word count, see the entropy update as you go, and export a batch when you need many at once.

Open PasswordForge

Other strength questions